MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af85081a6d3c6a59e34ab8c6a49e4d1c1d80b8b6a4417b879b6befa72cc4b997. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af85081a6d3c6a59e34ab8c6a49e4d1c1d80b8b6a4417b879b6befa72cc4b997
SHA3-384 hash: 685e46933b97387b4c0c6a81627f67ca3d9376fa1f36a9d4f828f0abc602db4cbc700de42d98a1d1e75a1b986fb736a3
SHA1 hash: 08a82caa4f9a470fb81792c3b36f6e8c15c62a3a
MD5 hash: 0fe3e612e606522bdf1d1b7bdc115b7e
humanhash: harry-romeo-mike-low
File name:13fa9342dbf4c500338c65fc9d095273.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'008 bytes
First seen:2020-04-01 16:47:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:n8J8GY2UGlk+XUQCQ3F40zf7fZUfLIBA2TTeDeBeedNFbmoqT7:8J8G0J+k+42bXXw27CoqT7
Threatray 10'547 similar samples on MalwareBazaar
TLSH F7543A6D2B88BA02F73D493249E1666012F295834E12CB4F3EC51FFD7F667C9284A395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=14H9I5gFZ89r8anyvTCUqMfTzbE4nMp4L

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-01 17:35:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
30 of 47 (63.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v6cqqgtnhrvfty2kxddkjhsndqoybofwuraxxb43npx2olgexglq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
04fd9df0e5ec9e9f2ddebfa497adbe3c57876dd52d8b778cee3701f21cf02986
AgentTesla
0cb6d17c8e1872666af107191c97fb8a73c5b3882b7b63b41cd4b166e8f7667e
AgentTesla
1d10fca85f5a06e20a160299e6f8f4a528384a77934fce0d44f48cb7e6f5feb4
AgentTesla
2ac203d2ba2fc79f4fa43ea2fff3b6e2d9a30bb8d73f6c809c50f8882913b373
AgentTesla
407a92dc3261682d19c7e6431b78c67470a498079f261d3c729d2e89b689b573
AgentTesla
8cacb4c01a703f8a300130d23fe74ab651ce7916a701357cb14b468e2a816a3d
AgentTesla
9590ae687d26247a1ca6c442dea11ce1b0d0add68bde8392bd0fccf98c54d94f
AgentTesla
ae2ac49c5b371950d8f7c7091e8073f6dfcd4d6663244ca76dc353a0fcbad9c3
AgentTesla
b2dfba1ce7b2522089f2d409187d5661483e581e893f7fb6fa681b5dbebed71c
AgentTesla
c371004e8407621dcf815c95f130ef0bbfeec0dfcee1433800e56a9b247b8702
AgentTesla
+ 10'537 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

f57eb9c191aa89dcbe172279da3dbaa37a94e528303ece5ac8aa9ad6e23240da

AgentTesla

Executable exe af85081a6d3c6a59e34ab8c6a49e4d1c1d80b8b6a4417b879b6befa72cc4b997

(this sample)

  
Dropped by
MD5 13fa9342dbf4c500338c65fc9d095273
  
Dropped by
MD5 aea400382d8bcbca62aa4b6b6769d450
  
Dropped by
GuLoader
  
Dropped by
SHA256 f57eb9c191aa89dcbe172279da3dbaa37a94e528303ece5ac8aa9ad6e23240da
  
Dropped by
SHA256 e867e97c16b80c38bd5d96b766a2c0e6e2cab9a1113821eb8cec95d731780cad
  
URLhaus
https://urlhaus.abuse.ch/url/333541/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments